I saw an advert on TikTok on 28 October 2026 for an AI porn or roleplay app. It featured an AI-generated woman undressing, accompanied by the sort of moaning audio that leaves very little doubt about what the advert was trying to sell.
I am a gay man.
Apparently, this is relevant information to an advertising industry that has spent decades collecting data about people, building profiles of their interests, predicting their behaviour, and selling advertisers the promise that it can put the right product in front of the right person at the right time.
Ah yes, an adult man. Quick, fetch the wank rag and the heterosexual porn mags.
I was born in 2005, grew up in the United Kingdom, and still live here. I turned eighteen in August 2023. I am twenty-one now. I have spent most of my life surrounded by the modern internet, and I have watched it become increasingly comfortable treating every scrap of information about us as a potential commercial opportunity.
I cannot prove that TikTok has read everything I have ever written, reconstructed my entire personality, and deliberately decided that I would appreciate an advert for AI-generated heterosexual pornography. Seeing an advert does not tell me precisely which signals were used to select it, whether it was served through broad targeting, or whether any particular inference was made about me.
That uncertainty is part of the problem.
These platforms want me to believe that their recommendation systems are sophisticated, their advertising highly personalised, and their data collection valuable. But when an advert seems wildly inappropriate, the mechanics behind it become difficult to see. I am expected to accept the benefits of personalisation without having much ability to scrutinise its decisions.
I have been thinking about this for years. I have complained about advertising, written about data collection, built software around personal data, and tried to understand what happens when the information we leave behind becomes more commercially valuable than the people who produced it.
And there is one particularly irritating fact I keep coming back to: I can host my website with zero first-party tracking and cookies.
I do not need to turn my visitors into advertising profiles to publish writing on the internet. I do not need to install trackers that follow their behaviour around my site. I do not need first-party tracking cookies to make my words available to readers.
If I can make that choice as an independent developer, why are we so often encouraged to treat invasive tracking as an unavoidable feature of the modern internet?
I am not claiming that every technical operation performed by a hosting provider can be eliminated. I am saying that there is a difference between the infrastructure required to deliver a website and the additional machinery a site operator chooses to use to monitor visitors.
That distinction should be obvious. Somehow, in discussions about advertising, it is often buried beneath the assumption that collecting more data is simply how things have to work.
I did not discover advertising yesterday
My frustration did not begin with TikTok.
It did not begin when generative AI became capable of producing increasingly convincing images of people who do not exist. It did not begin with Elon Musk's Grok or with the latest wave of applications marketed around artificial intimacy, digital undressing, and automated sexual content.
I grew up with advertising everywhere.
I grew up in the United Kingdom during a period when the internet was becoming a normal part of daily life, when online services were increasingly funded through advertising, and when personalisation was presented as an obvious improvement over the old internet. I have spent my life watching companies turn convenience into dependency and then turn that dependency into a business model.
I am twenty-one in 2026. I cannot remember a world in which the internet was not already commercially significant. I have never had the experience of growing up with an internet wholly separate from the advertising industry.
That does not mean advertising itself is inherently illegitimate. Websites cost money to host. Artists deserve to be paid. Businesses need to tell people that their products exist. A small creator advertising their work is not equivalent to an international platform building a behavioural profile of everyone who uses it.
There is a difference between showing somebody an advert and constructing an infrastructure designed to observe, classify, predict, influence, and monetise them.
The first web banner advertisements appeared on HotWired in 1994. By 2000, the Federal Trade Commission was already investigating the privacy implications of online profiling in a report to Congress. These are not new concerns. They are not problems that emerged because nobody anticipated the consequences of smartphones, social media, or generative AI. The industry has been arguing about online tracking and profiling for decades.
The technology has changed enormously. The basic commercial temptation has not.
Collect information. Find patterns. Build a profile. Sell access to an audience. Claim the result is useful because it is personalised.
The more sophisticated the system becomes, the greater the temptation to collect more information and draw increasingly ambitious conclusions from it.
And the more information a company has, the more it can promise its advertising customers that it knows what people want.
At some point, a reasonable question becomes unavoidable: what happens when the system thinks I want something that I do not want at all?
Cookies are only the beginning
When people discuss online tracking, cookies tend to dominate the conversation.
They have become shorthand for a much broader set of practices: banners asking us to accept or reject tracking, browser settings, consent dialogues, and companies trying to persuade us that our privacy choices can be reduced to a single button.
Cookies matter. They are also not the whole story.
The UK's Information Commissioner's Office has guidance covering what it calls storage and access technologies, including cookies, tracking pixels, link decoration, web storage, fingerprinting techniques, scripts, and tags. Its guidance explains how the Privacy and Electronic Communications Regulations, or PECR, and UK GDPR apply in relevant circumstances. The ICO finalised updated guidance on 29 April 2026, following consultations and changes to PECR under the Data (Use and Access) Act. The details are set out in the ICO's guidance on storage and access technologies.
The important distinction is that online tracking does not begin and end with whether a website puts a cookie in my browser.
Information can be gathered through multiple mechanisms. Different systems can collect different pieces of information. Those pieces can be processed together, retained, passed to other organisations, or used to make inferences.
Some information may be provided directly by a user. Some may be observed through interactions with a service. Some may be inferred from patterns.
The last category is especially interesting.
A company does not necessarily need to know something explicitly to make a prediction about it. It can observe behaviour and assign a probability to a characteristic, preference, or likely future action. That prediction might be right. It might be wrong. It may be based on patterns that say more about a broad demographic than about the particular person looking at the screen.
Once a prediction enters an advertising system, it can become commercially consequential even when its accuracy is questionable.
The system does not need to understand me in the human sense. It needs to produce a prediction that is useful enough to sell.
The distinction between knowing and predicting is easy to lose when companies describe their products in terms of intelligence, personalisation, and relevance.
I do not want to pretend that every company knows everything about me. I also do not want companies to hide behind the fact that they cannot know everything. A system can be invasive without being omniscient. It can be harmful without being perfectly accurate.
The problem is not that advertising platforms possess a complete, infallible picture of my life. The problem is that they can collect and infer enough to make decisions about what I see, while giving me limited visibility into how those decisions are made.
And, importantly, none of that proves that a website has to track its visitors to function.
My website is evidence that this is a choice
My own website matters to this argument because it is something I have actually built and operate, rather than a hypothetical alternative I am asking a multinational company to imagine.
I can publish my writing without deploying first-party tracking. I can serve pages without installing first-party tracking cookies. I can make my content available without building an advertising profile of each visitor.
That is not a theoretical design philosophy. It is a practical choice about how I run my website.
There is no advertising dashboard I need to feed with visitor identities. There is no requirement that I follow readers around my site to understand whether they have visited one article after another. I do not have to collect a behavioural history of every reader before I am allowed to publish a blog post.
I can simply publish the writing.
The point is not that every website has the same requirements. An online shop may need a shopping basket. An account-based service may need authentication. A site may have security, accessibility, performance, or operational requirements that call for particular kinds of processing. Different purposes demand different technical choices.
The point is that those requirements should be assessed individually. A service needing to deliver a page is not, by itself, a justification for creating an advertising profile of the person who requested it.
My website is hosted on Vercel. That means I am not claiming that no organisation processes any information when somebody visits. Vercel's privacy notice explains that it may process information such as end-user IP addresses, request information, device information, and service-generated logs.
A hosting provider receiving an IP address as part of an ordinary web request is not the same as me deliberately adding first-party tracking to my site. The purposes, control, and technical mechanisms differ. I would not claim that my website prevents every form of infrastructure-level logging, nor that hosting providers can deliver pages without processing the information needed to handle network requests.
That distinction makes my point more precise, not less important.
Zero first-party tracking and cookies does not have to mean zero infrastructure processing. It means I have chosen not to add first-party tracking and cookies as a feature of my website.
The fact that some processing may be necessary to deliver a page does not justify collecting everything else that might be commercially useful.
I do not need to treat each visitor as an opportunity to accumulate more data. I do not need to know their browsing history across unrelated websites. I do not need to infer their sexuality, health status, political views, or purchasing habits in order to put a paragraph of text on a screen.
If I can make those choices, the industry should at least be able to explain why it believes its own additional collection is necessary and proportionate.
It is not enough to say that tracking is standard practice. The fact that a practice has become common does not make it inevitable, ethical, or necessary.
I have already written about being turned into data
This is not an abstract concern for me.
I have written about the uncomfortable distance between a numerical representation of a person and the person themselves.
In A Number on a Spreadsheet: When Everything Becomes Data, I explored the way information can become detached from the human experience it is supposed to describe.
A number can be useful. Several numbers can reveal patterns. A dataset can tell us things we would never discover by looking at an individual observation in isolation.
But a dataset is not a person.
A count of posts cannot tell you everything about why somebody wrote them. A listening history cannot explain the role music has played in someone's life. A record of interactions does not reveal every context in which those interactions occurred. A list of interests cannot capture every contradiction, uncertainty, private feeling, or change of mind.
Even an extensive archive is incomplete.
On 28 October 2026, my decoded AT Protocol archive contained 147,137 records across 185 collections. That included 9,432 Bluesky posts, 9,772 reposts, 3,882 likes, 1,279 follows, 389 blocks, and 644 Standard.site documents.
Those numbers look substantial when listed together. They describe a considerable amount of activity across the services and applications represented in the archive.
They still do not describe me.
My music-listening history alone contained 112,511 records, spanning September 2021 to October 2026. Within that archive, Powerwolf appeared 7,417 times, Epic Mountain 3,247 times, Ethan Bortnick 2,434 times, Cjbeards 2,429 times, and DAGames 2,193 times.
Those counts are facts about the records in my archive. They are not a complete account of my musical taste, let alone my entire life.
Listening counts cannot explain how a song made me feel when I first heard it. They cannot tell you whether a particular piece of music helped me through a difficult time. They cannot reduce the meaning of music to a leaderboard.
The same limitation applies to social activity.
A follow might indicate interest, friendship, professional curiosity, or simply a desire to keep track of an account. A repost might be an endorsement, criticism, joke, or attempt to preserve something for later. A block might be a personal boundary rather than a statement about everything a person believes.
Numbers can tell us what was recorded. Interpreting those records requires context.
And context is precisely what the commercial data economy is often willing to sacrifice.
When a platform converts my behaviour into categories, those categories may be useful to advertisers even if they are incomplete or wrong. A model can make a prediction from correlations without knowing why the correlation exists. It can classify a person based on patterns without understanding that person's intentions.
This is why I am uncomfortable with the assumption that having a great deal of data means a company necessarily understands the people who produce it.
It might understand how to predict certain actions. That is not the same thing.
It is also important to be clear about what my archive proves. It is my collection of AT Protocol records. It does not demonstrate that TikTok has accessed the archive or that any particular company has ingested every post, like, follow, or listening record I have ever produced.
I do not need to claim that TikTok has my entire digital life in order to criticise the incentives that encourage companies to collect and exploit personal information.
The system is troubling enough without inventing evidence.
The advertising history is longer than one bad advert
The TikTok advert on 28 October 2026 was the latest example in a much longer history of adverts that have felt inappropriate, irrelevant, irritating, or simply absurd.
In August 2024, I saw a Christmas advert on Spotify. Later that month, I encountered an Apple Music trial advert. In October 2024, Spotify showed me adverts for the Mormon Church, despite my being gay.
In December 2024, while I was watching Minecraft Alpha content on YouTube, I encountered adverts for pornographic games.
In March 2025, I saw a French-language advert for Assassin's Creed Shadows. In September 2025, Christmas advertising appeared again.
Then, in November 2025, a cider advert appeared shortly after my twentieth birthday.
I was born in 2005 and turned eighteen in August 2023. I was twenty when I saw that cider advert. It did not appear immediately after I became an adult; it was another example, more than two years later, of advertising that made me wonder what assumptions a platform was making about me.
In December 2025, I encountered advertising for pornography, alcohol, gambling, and cryptocurrency. In August 2026, YouTube showed me Mormon advertising again, despite my being Pagan. In September 2026, TikTok showed me an advert for Visible Health, which made me wonder whether the advertising system was drawing conclusions about my health.
I cannot prove that the Visible Health advert was served because TikTok inferred something about my health. It might have been broad targeting, a campaign aimed at a much wider audience, or some other mechanism. The fact that I wondered about a connection is not evidence that the connection existed.
That is a recurring problem with personalised advertising. The experience gives the user a reason to suspect an explanation, but the information available to the user is often insufficient to confirm it.
And now there is the AI-generated porn advert.
These experiences are not all identical. They come from different platforms, different campaigns, and potentially different methods of ad delivery. I am not claiming that every one was targeted at me using the same information, or that every advert violated a law or policy.
What links them is the repeated experience of being placed in front of advertising that seems poorly matched to my interests, identity, or circumstances, while the companies involved sell sophisticated systems for delivering relevant content.
A platform does not need to get every advert right. No recommendation or advertising system can be perfect. I understand that.
But the gap between the promise and the experience becomes difficult to ignore when the same kind of mismatch keeps happening across years and services.
The question is not whether one badly chosen advert proves that an algorithm is broken. It does not.
The question is why these systems are so comfortable making assumptions about people while offering so little explanation when those assumptions appear to be wrong.
I am not a heterosexual man-shaped advertising opportunity
The TikTok advert is particularly frustrating because of what it seemed to assume about its audience.
I am a gay man. I am not interested in heterosexual pornography simply because I am an adult man.
That should not be a difficult concept to understand. Sexual orientation is not an obscure edge case that the advertising industry has only just discovered. It is a basic fact about human diversity.
Yet much of the advertising I have encountered seems to treat adulthood as a sufficiently complete description of a person to justify showing them sexualised material.
The reasoning may be something like this: the user is an adult; the advert is for sexual content; adults might be interested in sexual content; therefore the advert is worth showing.
This may not be how the particular campaign or advertising system actually operated. I do not know its targeting parameters, the advertiser's settings, the audience categories available, or the reason for this individual impression. I cannot see the internal decision that resulted in the advert appearing on my screen.
But the resulting experience is still absurd.
There is a difference between recognising that a person is legally an adult and assuming that they are interested in any product intended for adults. A person can be old enough to purchase alcohol without wanting cider. They can be old enough to view adult content without wanting pornography. They can use social media without wanting to be sold every product that could conceivably interest somebody in their demographic.
People are not shopping categories with legs.
I also do not want the solution to be a demand that platforms collect ever more intimate information about me. I do not want to provide a detailed sexual profile to advertising companies merely to reduce the likelihood of seeing adverts that are irrelevant to me.
That would be a deeply perverse outcome: in order to stop companies making assumptions about my private life, I would have to disclose more of my private life to them.
There is a difference between giving people control over the advertising they see and requiring them to expose more sensitive information in order to obtain that control.
The goal should be to reduce unnecessary intrusion, improve relevance where that can be achieved responsibly, and give users meaningful ways to object to adverts they find inappropriate.
I should not have to prove my sexuality to a company to establish that it should not treat heterosexual pornography as an obvious fit for me.
The AI porn problem is bigger than my feed
The advert I saw was not proof that TikTok knowingly targeted me on the basis of my sexuality. It was, however, a reminder of a broader issue: sexually suggestive AI applications have become part of the advertising ecosystem, and companies responsible for hosting adverts need to be able to enforce their own rules.
TikTok's Adult Content Advertising Policy prohibits several categories of advertising involving sexual services and sexually suggestive content. Its rules address categories including AI nudify applications and imagery depicting stripping or undressing.
In April 2026, Business Insider reported on an investigation that found more than fifty sexually suggestive advertisements for AI tools and websites capable of generating sexualised deepfake images, including tools that digitally undress people in photographs. The report covered adverts seen between December 2025 and February 2026 and described additional removals after TikTok was notified.
That investigation does not establish that my particular advert was among those examined. It does not prove that the advert I saw violated TikTok's policy. Nor does it mean every AI-generated character or every roleplay application is equivalent to a service producing non-consensual sexual imagery.
Those distinctions matter.
There is a meaningful difference between an entirely fictional character, an adult consensually creating sexual material, and a tool that uses somebody's likeness to produce sexual imagery without their permission. The latter can cause serious harm, particularly when a real person's image is used to make material they never consented to create or share.
AI does not erase those distinctions. It makes the technology more accessible and increases the scale at which abuse can occur.
The concern is not simply that an advert contains an attractive fictional character or tries to appeal to an adult audience. It is that the market for AI-generated sexual content overlaps with products that can enable exploitation, non-consensual imagery, and the objectification of real people.
Advertising is one of the ways those products attract users.
If a platform prohibits a category of advertising, that prohibition ought to mean something beyond a paragraph on a policy page. Enforcement has to work in practice, not just in principle.
That does not mean every problematic advert proves deliberate corporate approval of every harmful use of a product. Large advertising systems process huge volumes of material, and no moderation process is infallible. But the scale and complexity of a system are reasons to build stronger safeguards, not reasons to excuse repeated failures.
A company that profits from advertising has an interest in keeping adverts flowing. It also has a responsibility to prevent its service from becoming a distribution channel for material it says it does not permit.
The two interests can conflict. That is exactly why rules and oversight matter.
Grok is an especially ugly warning
The rise of AI-generated sexual imagery is not limited to advertisements for apps.
Elon Musk's Grok has been the subject of substantial controversy over sexualised deepfakes and non-consensual imagery. The issue is not merely that an AI system can generate fictional pornography. It is that generative tools can be used to create sexualised images of identifiable people who did not consent to those images being made.
That is a fundamental difference.
In February 2026, Reuters reported that its journalists tested Grok's image-generation systems and obtained sexualised, humiliating imagery in 45 of 55 prompts during one round of tests and 29 of 43 in another. Those figures describe Reuters' particular prompts and test circumstances. They are not universal measurements of the probability that Grok will comply with any request, and they do not establish that every image generated was fully nude or depicted an explicit sexual act. The results and methodology are discussed in Reuters' report on its Grok tests.
On 11 June 2026, Canada's Privacy Commissioner announced that an investigation had found that X Corp. and xAI violated Canada's federal private-sector privacy law. The investigation concerned Grok's generation and disclosure of sexualised deepfakes, including questions about consent and whether the processing was appropriate in the circumstances. The Commissioner's findings are available in the official announcement.
In the United Kingdom, Ofcom's investigation into X's compliance with the Online Safety Act continued. Its update on 14 October 2026 described the evidence it had gathered concerning sexual deepfakes and outlined the remaining work to determine whether X had complied with its legal duties. Ofcom also reported restrictions introduced for the standalone Grok service following regulatory engagement, including restrictions affecting UK IP addresses and the generation, viewing, and sharing of pornography through its image-generation technology.
As of that update, Ofcom had not announced a final finding that X had breached the relevant duties under the Online Safety Act. The status of the investigation and the measures described are set out in Ofcom's 14 October 2026 update.
The broader point is that AI-generated sexual imagery is not a harmless novelty simply because a machine generates it. When the output depicts identifiable people, the consequences reach into privacy, dignity, reputation, and consent.
The ability to produce something does not create a right to produce it. The ability to automate a harmful act does not make the act morally neutral.
I have built software myself. I know that an implementation can be technically impressive and still be irresponsible. A feature can work exactly as designed and still create problems that should have been anticipated.
The question is not whether a model is powerful. It is whether the people deploying it have taken reasonable care over what that power makes possible.
The app stores have rules too
Apple and Google have policies addressing sexual content and the misuse of AI-generated material.
Apple's App Store Review Guidelines restrict overtly sexual or pornographic material and set expectations for applications involving user-generated content, including AI content-creation tools. Google's Google Play policiesprohibit pornography, non-consensual sexual content, and applications that claim to undress people or see through clothing. Google's AI-generated content policy also identifies non-consensual sexual deepfakes and applications primarily intended to provide sexual gratification among examples of prohibited content.
These rules are not interchangeable. Apple and Google operate different review and distribution systems, and an application may be distributed through a website or another route rather than either company's main store. A policy also does not guarantee that every violation will be detected.
I am not claiming that the particular application advertised to me was listed in either store, was submitted for review, or had been rejected. I do not have evidence for any of those claims.
The point is that the industry already recognises that certain forms of sexual content and AI-generated imagery need restrictions. The challenge is applying those restrictions consistently across the systems that distribute, promote, and monetise the products.
There is a tendency for companies to draw narrow boundaries around their own responsibilities. A platform may say it only hosts content. An app developer may say it only provides a tool. An advertising network may say it only distributes an advertiser's campaign. A model provider may say it is not responsible for everything a user generates.
Each statement may describe part of the technical arrangement. Taken together, they can become a way of ensuring nobody feels responsible for the outcome.
That is not good enough.
A product's architecture does not remove the responsibilities of the organisations that design, deploy, advertise, and operate it. Nor does the presence of multiple organisations mean that responsibility must become so fragmented that nobody has to act.
Being in the United Kingdom matters
I am writing this as someone who grew up in the UK and continues to live here. That context matters because online advertising and privacy are not governed only by the terms and conditions of American technology companies.
The UK has its own legal and regulatory framework, including UK GDPR, the Privacy and Electronic Communications Regulations, and the Online Safety Act 2023.
These laws do different things. UK GDPR governs personal-data processing within its scope. PECR covers particular aspects of electronic communications and the use of storage and access technologies. The Online Safety Act establishes duties for relevant services concerning online safety, including requirements relating to illegal content.
None of this means every irritating advert is illegal. Nor does it mean that an advert I dislike automatically demonstrates a breach of data-protection law. The facts matter, the legal provisions matter, and the responsibilities involved differ between services.
But the existence of these frameworks means that online privacy and safety are not merely matters of personal preference.
The ICO's guidance explains that PECR can apply to technologies that store information on, or access information stored on, a user's device. Where personal data is processed, UK GDPR may also apply. The legal treatment depends on the technology and circumstances, including applicable exceptions and requirements.
This is more substantial than a generic promise to respect privacy. It is a legal framework that organisations are expected to understand and follow.
The same principle applies to online safety. Ofcom's work on X and Grok illustrates that UK regulators can investigate how services handle potentially illegal content and whether their systems meet legal duties. Investigations can take time, and an investigation is not the same as a final decision. Nevertheless, the process demonstrates that a company's own policy statements are not necessarily the final word on whether it has met its obligations.
The UK context also gives me a particular reason to object to the idea that the only practical answer to a problem is to accept whatever the largest international platforms decide to do.
These services may operate across borders, but they are not beyond accountability in every jurisdiction. If a company chooses to operate a service that reaches people in the UK, the relevant laws and regulatory requirements cannot simply be dismissed as somebody else's problem.
There should be room to debate whether particular rules are well designed, whether their enforcement is effective, and whether an intervention is proportionate. Those are legitimate questions.
But that debate should begin with the recognition that people deserve meaningful protection and companies have obligations beyond maximising engagement and revenue.
I should not have to choose between participating in contemporary digital life and accepting that every part of my attention, behaviour, and personal information is available for commercial exploitation.
Personalisation is not always an improvement
It would be easy to turn this entire discussion into a complaint about adverts. That would miss a larger issue.
The same commercial logic influences recommendation systems, content ranking, engagement metrics, and the ways online services organise information.
I have seen recommendations that were genuinely useful. I have also seen recommendations that felt disconnected from what I wanted at the time.
On 19 May 2026, I posted about Spotify's Pagan Folk Mix. On 27 May, TikTok surfaced a creator I followed. On 8 October, TikTok recommended Wolfblood.
Those are observations about things I saw or experienced. They do not demonstrate that the services used the same information, that one service's data was transferred to another, or that any particular recommendation was based on an invasive inference. A recommendation may result from ordinary engagement signals, direct follows, broad popularity, or several other mechanisms.
The difference between content recommendation and advertising delivery matters. Seeing a programme recommended is not the same as receiving a paid advert for a product. The systems can have different purposes and use different signals.
Still, both are examples of services deciding what to place in front of a user.
Recommendations can help people discover music, software, writing, films, communities, and interests they would not otherwise have encountered. I do not want to pretend that personalisation never provides value. It can be genuinely useful.
The danger is the assumption that anything which improves engagement must improve the user's experience.
A recommendation can be effective at keeping somebody on a platform while making them miserable. An advert can be effective at attracting attention while being irrelevant or intrusive. A feed can be highly personalised without giving the person using it any meaningful understanding of why particular material appears.
The metrics may record a click, a view, a replay, or a purchase. They do not necessarily record whether a person felt respected, whether the experience was welcome, or whether the system's decision was justified.
That is part of what concerned me when I wrote A Number on a Spreadsheet. The measurable outcome is not the whole human outcome.
I also wrote Why I've Grown to Hate Spotify: A Tale of Ads and Lost Control, which describes my frustration with advertising and the diminishing sense of control over the services I use.
This is not a sudden objection prompted by one awkward TikTok impression. It is a recurring concern about systems that mediate my access to things I enjoy and then use that access to monetise my attention.
There is a difference between a service helping me find something and a service treating my continued attention as the objective.
I want tools that help me do things. I do not want every tool to become an increasingly elaborate mechanism for keeping me engaged long enough to show me another advert.
I have tried to build things differently
Part of the reason this bothers me so much is that I build software myself.
My projects are not equivalent in size, reach, resources, or influence to TikTok, Spotify, Google, Apple, or X. I am not pretending that a collection of independent software projects has the same operational constraints as a global platform serving millions of people.
The scale is different. So are the resources and the consequences of failure.
But the underlying question about responsibility still matters.
I have worked on tools that handle personal data, music history, social records, and the AT Protocol ecosystem. I have built projects because I wanted more control over my data and a clearer understanding of what my tools do.
One example is Malachite, part of my pkgs repository on GitHub, which transfers music-listening history to Teal. On 22 October 2026, I reported that 2,060,527 records had been imported.
That is a record count, not a count of users. It does not establish that every record was correct, and it is not a claim that millions of people use the software. It describes the scale of the records involved in that import process.
I mention it because the work of handling personal history has made the gap between a dataset and the person represented by it concrete. Data can be exported, converted, imported, validated, and counted. Those operations are important, but they do not mean that a service understands the human meaning of the material it handles.
Another example is Inkwell, a native iOS and Android reader and writer for the Standard.site ecosystem on the AT Protocol. It makes choices about converting content between representations, and those conversions are not always lossless. I disclose that limitation rather than pretending every document can always be transformed without consequences.
Inkwell is distributed through AltStore Classic and F-Droid rather than the Apple App Store or Google Play. That is a description of its distribution, not a claim that Apple or Google rejected it for particular content or policy reasons.
My Sine project distinguishes observations from inferences, exposes uncertainty, validates generated recommendations, and filters tracks that have already been played. Those design decisions reflect a principle I think is important: a system should not present a guess as though it were an established fact.
ATperson explores provenance and deterministic reconstruction. Wolfram works on an AT Protocol C23 SDK. MetalBear is concerned with an AT Protocol personal data server. PlainSpeak explores a systems language with testable compatibility and conformance.
These projects serve different purposes. They are not all privacy products, and I do not claim they solve the industry's problems. They do reflect an interest in systems that are understandable, testable, and explicit about what they do.
The underlying principle is that software should make it possible to establish what happened, distinguish evidence from assumptions, and identify where responsibility lies.
That principle becomes especially important when a system uses personal information to make decisions about a person.
If a conversion loses data, the limitation should be documented. If a recommendation is inferred rather than observed, it should be treated as an inference. If a bug causes records to be mishandled, it should be investigated and fixed. If a system is uncertain, it should not pretend to be certain simply because certainty makes a better sales pitch.
I do not get to abandon those principles because a task is complicated or because I used a dependency somebody else wrote. The responsibility is mine. All of it.
That does not mean an individual developer can prevent every possible misuse of their software. It does mean I am responsible for taking reasonable care, being honest about the limitations of my work, and responding properly when something goes wrong.
I hold large companies to a similar standard, adjusted for their resources, responsibilities, and scale.
The responsibility of a global technology company is not identical to that of an independent developer. It is often greater, precisely because the company has more resources, more users, more influence, and greater capacity to prevent foreseeable problems.
A company cannot reasonably claim that the complexity of its own systems makes meaningful accountability impossible.
My own website is not a claim of perfection
I want to be precise about what my website demonstrates.
I can host it with zero first-party tracking and cookies. I can choose not to install analytics scripts, advertising pixels, session recorders, or other first-party tracking mechanisms simply to observe what visitors do.
That does not mean the site magically escapes every network-level consequence of being online. The hosting infrastructure must still receive requests and deliver responses. Security and operational services may process technical information. If I add features that require accounts or authentication, those features can introduce additional considerations.
I am not claiming that Vercel never logs anything, that no third party can process information when a visitor loads a page, or that hosting providers have no legitimate operational needs. Vercel's own privacy notice makes clear that its services can involve processing request and device information.
I am making the narrower and more relevant claim: I do not need to install first-party tracking and cookies on my website to publish my writing.
That choice puts the burden of justification where it belongs.
If a company wants to collect more information than is needed to provide its service, it should explain why. If it wants to track behaviour for advertising, it should be transparent about the practice and provide the controls and choices required by the applicable rules. If less intrusive methods are available, the company should take them seriously.
The mere fact that analytics tools exist does not mean they are necessary. The fact that behavioural advertising is profitable does not mean every website needs to use it. The fact that many companies track visitors does not make tracking a technical requirement of the web.
The internet can publish a page without a first-party advertising profile attached to every reader.
My website is a small example, not proof that every platform can operate without any data processing whatsoever. It is evidence that the decision to add first-party tracking is a decision, rather than an unavoidable part of writing something and making it available online.
The scale of my website and the scale of a multinational advertising platform are radically different. I am not saying that my operating model can be transplanted unchanged into every commercial service. I am saying that larger organisations should be able to identify the specific purpose served by each additional form of data collection instead of treating surveillance as the default.
There is a meaningful difference between collecting the information required to provide a service and collecting additional information because it might help monetise the person using it.
That difference should be reflected in product design, company policy, and public accountability.
Privacy should not require me to understand every part of the machinery
I do not think ordinary users should need to become privacy engineers to understand the choices available to them.
I am interested in technical systems. I read documentation, build software, examine data structures, and care about how services work. Even with that interest, there are limits to what I can determine about a particular advert or recommendation from the outside.
I cannot inspect TikTok's internal auction for a particular impression. I cannot see every audience definition supplied by the advertiser. I cannot know which signals were available to the delivery system, which were actually used, or whether an apparently personal result was simply the outcome of a broad campaign.
A screenshot of an advert cannot establish all of that.
That is not an argument against investigating how advertising works. It is a reason to recognise the limits of the evidence and to ask for better transparency.
A user should be able to find meaningful information about why an advert was shown, which organisations were responsible for it, how to report it, and what practical choices are available to prevent similar adverts from appearing.
Those explanations will not always reveal every detail of a commercial advertising system, and there may be legitimate reasons not to publish certain security-sensitive or commercially confidential information. But commercial confidentiality should not become a universal excuse for making decisions about people impossible to scrutinise.
Likewise, privacy controls should not be designed primarily to persuade users to accept the most intrusive option.
A consent interface that makes refusal unnecessarily difficult does not demonstrate respect for a user's choice. A platform that allows a person to hide an advert but gives them no useful explanation of why it appeared has offered some control, but not necessarily meaningful transparency. A privacy policy that technically discloses dozens of categories of processing is not automatically understandable.
There is a difference between making information available and making it usable.
Contextual advertising can, in appropriate circumstances, rely on less personal-data processing than behavioural advertising because the content being viewed, rather than a behavioural profile, can be used to select the advert. That is not a perfect solution to every privacy problem, and its legal treatment depends on the specific circumstances. The ICO's guidance on how storage and access technology rules apply to online advertising explains some of the relevant distinctions.
The question is worth asking: does a platform need to build such an extensive picture of me in order to show me an advert?
Sometimes the answer may be no.
A service can show an advert based on the content being viewed, the broad subject of a page, or a campaign intended for a general audience. It does not always need to infer the user's sexuality, health, personality, or private interests.
If less intrusive methods can serve the purpose, they deserve serious consideration.
The choice should not be between perfect personalisation and no advertising at all. It should include approaches that reduce how much personal information is collected, inferred, shared, and used.
I have been complaining about this for years
On 19 January 2025, I wrote that if Bluesky eventually added advertising, I would probably look for another AppView that gave me an ad-free experience.
That was not a claim that all advertising was morally wrong or that Bluesky had already introduced the kind of advertising I dislike. It was an indication of how little confidence I had that a service which became dependent on advertising would remain aligned with my preferences.
I want to be able to use social services without feeling that my attention is the product around which everything else has been arranged.
The ability to choose a different interface or an alternative implementation matters because it gives people some room to exercise agency. It does not solve the entire problem of centralised infrastructure or data collection, but it can make a difference to what users are exposed to and how they interact with a service.
That is part of why I build things. It is part of why I am interested in open protocols, independent implementations, and software that lets people retain meaningful control over their own data.
There is no single technology that will fix every issue described in this post. An alternative client cannot necessarily control the behaviour of a server it depends on. An open protocol does not automatically prevent abuse. A self-hosted service still needs responsible administration. A local application can still mishandle data.
I do not think the answer is to assume every independent project is good and every large company is bad.
The answer is to ask better questions about the systems we use. What does the software do? What does it collect? What does it share? How does it make decisions? What can the user control? What happens when it fails? Who is accountable?
I want those questions to be ordinary parts of designing and evaluating software, not special concerns raised only after a scandal.
I also want companies to stop presenting personalisation as an unquestionable good. Sometimes a recommendation is useful. Sometimes it is wrong. Sometimes a more targeted advert is not worth the privacy cost of delivering it. Sometimes the right answer is to show less, collect less, or stop trying to infer so much.
More data is not always better. More personalisation is not always better. More engagement is not always better.
And a system that knows more about a person is not necessarily a system that treats them better.
What I want to change
I want advertising platforms to enforce their own policies consistently, particularly where sexualised AI products and non-consensual imagery are concerned.
I want users to be able to report problematic advertising and receive meaningful responses. I want platforms to make it possible to understand, at an appropriate level of detail, why a particular advert was shown. I want privacy controls that do not require users to disclose more sensitive information just to avoid inappropriate content.
I want meaningful alternatives to invasive behavioural advertising to be taken seriously. Contextual advertising, less intrusive personalisation, and sensible limits on data collection should be part of the conversation rather than treated as obstacles to the industry's preferred business model.
I want AI companies to build safeguards around foreseeable misuse, particularly where real people can be subjected to non-consensual sexual imagery. I want those companies to respond to credible evidence of failures instead of making users and victims carry the entire burden of identifying and mitigating the harm.
I want regulators to investigate credible concerns and explain their findings clearly. I want investigations to distinguish between allegations, evidence, provisional views, and final decisions. Accountability is stronger when the process is transparent and the conclusions are proportionate to the evidence.
I want websites and online services to stop treating first-party tracking as an automatic requirement. I want developers to ask whether each tracking technology serves a genuine need, whether there is a less intrusive alternative, and whether users can still use the service without being turned into a behavioural profile.
My own website demonstrates that a straightforward alternative is possible: publish the writing, deliver the pages, and do not add first-party tracking and cookies merely because the industry has normalised them.
That is not a universal solution for every kind of service. It is a useful baseline for asking why more intrusive approaches are being chosen.
None of this requires the internet to become free of advertising. It does not require every algorithm to be perfect or every recommendation to be correct. It does not require every system to avoid all data processing.
It requires the industry to accept that there are limits to what should be collected, inferred, promoted, and monetised. It requires companies to take those limits seriously when doing so conflicts with immediate commercial incentives.
It also requires a more honest relationship with users.
Tell me what a system does. Tell me what it does not know. Explain what choices I have. Do not imply that a prediction is a fact. Do not make me responsible for fixing every failure in a system I cannot inspect. Do not tell me that a harmful outcome is simply an unavoidable consequence of innovation when reasonable safeguards could have reduced the risk.
And do not pretend that the only way to fund the internet is to treat every person who uses it as a collection of advertising opportunities.
Get your fucking act together
I am twenty-one years old. I was born in 2005, and I have been an adult since August 2023. I have spent my life on an internet that has had decades to learn how to handle advertising, personal data, privacy, and the consequences of its own design choices.
The basic questions are not new.
The first web banners appeared in 1994. Regulators were investigating online profiling by 2000. The technology has become faster, more pervasive, and more powerful, but the fundamental problem remains: the incentives to collect information and monetise attention are often stronger than the incentives to respect the people behind that information.
Now those incentives operate alongside AI systems that can generate sexualised imagery, imitate people, and turn capabilities that once required specialist skills into accessible products. The potential consequences are serious, and the responsibility to build safeguards has not become less important simply because the technology is new.
I am tired of the excuse that everything is too complicated.
I am tired of being told that the system is sophisticated when a company wants to sell its capabilities, then mysterious when I want to understand an outcome. I am tired of policies that sound reassuring but do not always translate into effective enforcement. I am tired of the assumption that personalisation is worth any amount of intrusion.
And I am tired of the idea that tracking must be accepted as the price of having a place on the internet.
I can host my website with zero first-party tracking and cookies. I can publish my writing without deliberately turning visitors into advertising profiles. I can make choices about what my own website does and does not collect.
I am not claiming that my hosting provider processes nothing, or that every kind of online service can operate with no data processing whatsoever. I am saying that adding first-party tracking is not an unavoidable condition of publishing a website.
It is a choice.
The largest technology companies have far more resources than I do. Their services are more complicated, their responsibilities are broader, and their operating requirements are different. Those differences deserve to be taken seriously.
But they do not turn every form of tracking into a necessity. They do not excuse failing to distinguish between useful data and data collected because it might be profitable. They do not remove the obligation to justify intrusive choices.
I cannot prove why TikTok showed me that AI porn advert. I cannot tell you exactly which information the platform used or whether the advert was targeted to me individually at all. I will not invent an explanation simply because it would make a neater story.
But I can say what happened. I can explain why it bothered me. I can describe the history of advertising and profiling that makes the experience part of a larger problem. I can point to the policies, regulatory investigations, and documented failures that show why these concerns deserve serious attention.
And I can point to my own website as a small, concrete example of a different choice: a site can be hosted, its pages can be served, and its writing can be read without me deploying first-party tracking and cookies.
I do not expect every platform to know me perfectly. I do not expect every advert to be relevant. I do not expect every company to operate without mistakes.
I expect companies to collect less information when less will do. I expect them to make their policies meaningful. I expect them to distinguish between what they know and what they infer. I expect them to take reasonable care over foreseeable harms. I expect them to fix failures rather than hide behind complexity.
I expect them to remember that the person looking at the screen is not a profile, a predicted preference, a conversion opportunity, or a number on a spreadsheet.
The internet can do better than this. The people building it have had decades to learn how.
Get your fucking act together.
Comments
Checking AT Protocol sign-in…
No comments yet
Be the first to share your thoughts on this post.